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ABSTRACT. Canonical models are of central importance in modal logic, in particular as they wit- 
ness strong completeness and hence compactness. While the canonical model construction is well 
understood for Kripke semantics, non-normal modal logics often present subtle difficulties - up to 
the point that canonical models may fail to exist, as is the case e.g. in most probabilistic logics. Here, 
we present a generic canonical model construction in the semantic framework of coalgebraic modal 
logic, which pinpoints coherence conditions between syntax and semantics of modal logics that guar- 
antee strong completeness. We apply this method to reconstruct canonical model theorems that are 
either known or folklore, and moreover instantiate our method to obtain new strong completeness 
results. In particular, we prove strong completeness of graded modal logic with finite multiplicities, 
and of the modal logic of exact probabilities. 

In modal logic, completeness proofs come in two flavours: weak completeness, i.e. derivability of 
all universally valid formulas, is often proved using finite model constructions, and strong com- 
pleteness, which additionally allows for a possibly infinite set of assumptions. The latter entails 
recursive enumerability of the set of consequences of a recursively enumerable set of assumptions, 
and is usually established using (infinite) canonical models. The appeal of the first method is that it 
typically entails decidability. The second method yields a stronger result and has some advantages 
of its own. First, it applies in some cases where finite models fail to exist, which often means that the 
logic at hand is undecidable. In such cases, a completeness proof via canonical models will at least 
salvage recursive enumerability. Second, it allows for schematic axiomatisations, e.g. pertaining to 
the infinite evolution of a system or to observational equivalence, i.e. statements to the effect that 
certain states cannot be distinguished by any formula. 

In the realm of Kripke semantics, canonical models exist for a large variety of logics and are 
well understood, see e.g. [2 J. But there is more to modal logic than Kripke semantics, and indeed 
the natural semantic structures used to interpret a large class of modal logics go beyond pure re- 
lations. This includes e.g. the selection function semantics of conditional logics [4], the semantics 
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of probabilistic logics in terms of probability distributions, and the game frame semantics of coali- 
tion logic |[T6l . To date, there is very little research that provides systematic criteria, or at least 
a methodology, for establishing strong completeness for logics not amenable to Kripke semantics. 
This is made worse as the question of strong completeness crucially depends on the chosen semantic 
domain, which as illustrated above may differ widely. It is precisely this variety in semantics that 
makes it hard to employ the strong-completeness-via-canonicity approach, as in many cases there 
is no readily available notion of canonical model. The present work improves on this situation by 
providing a widely applicable generic canonical model construction. More precisely, we establish 
the existence of quasi-canonical models, that is, models based on the set of maximally consistent 
sets of formulas that satisfy the truth lemma, as there may be no unique, or canonical, such model in 
our more general case. In order to cover the large span of semantic structures, we avoid a commit- 
ment to a particular class of models, and instead work within the framework of coalgebraic modal 
logic [ 15 ] which precisely provides us with a semantic umbrella for all of the examples above. This 
is achieved by using coalgebras for an endofunctor T as the semantic domain for modal languages. 
As we illustrate in examples, the semantics of particular logics is then obtained by particular choices 
of T. Coalgebraic modal logic serves in particular as a general semantic framework for non-normal 
modal logics. As such, it improves on neighbourhood semantics in that it retains the full semantic 
structure of the original models (neighbourhood semantics offers only very little actual semantic 
structure, and in fact may be regarded as constructed from syntactic material [18 ]). 

In this setting, our criterion can be formulated as a set of coherence conditions that relate 
the syntactic component of a logic to its coalgebraic semantics, together with a purely semantic 
condition stating that the endofunctor T that defines the semantics needs to preserve inverse limits 
weakly, and thus allows for a passage from the finite to the infinite. We are initially concerned with 
the existence of quasi-canonical models relative to the class of all T-coalgebras, that is, whith logics 
that are axiomatisable by formulas of modal depth uniformly equal to one [171. As in the classical 
theory, the corresponding result for logics with extra frame conditions requires that the logic is 
canonical, i.e. the frame that underlies a quasi-canonical model satisfies the frame conditions, which 
holds in most cases, but for the time being needs to be established individually for each logic. 

Our new criterion is then used to obtain both previously known and novel strong completeness 
results. In addition to positive results, we dissect a number of logics for which strong completeness 
fails and show which assumption of our criterion is violated. In particular, this provides a handle 
on adjusting either the syntax or the semantics of the logic at hand to achieve strong completeness. 
For example, we demonstrate that the failure of strong completeness for probabilistic modal logic 
(witnessed e.g. by the set of formulas assigning probability > 1 — 1/n to an event for all n but ex- 
cluding probability 1) disappears in the logic of exact probabilities. Moreover, we show that graded 
modal logic, and more generally any description logic [1] with qualified number restrictions, role 
hierarchies, and reflexive, transitive, and symmetric roles, is strongly complete over the multigraph 
model of 10, which admits infinite multiplicities. While strong completeness fails for the naive 
restriction of this model to multigraphs allowing only finite multiplicities, we show how to salvage 
strong completeness using additive (finite-)integer-valued measures. Finally, we prove strong com- 
pleteness of several conditional logics w.r.t. conditional frames (also known as selection function 
models); for at least one of these logics, strong completeness was previously unknown. 

1. Preliminaries and Notation 

Our treatment of strong completeness is parametric in both the syntax and the semantics of a wide 
range of modal logics. On the syntactic side, we fix a modal similarity type A consisting of modal 
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operators with associated arities. Given a similarity type A and a countable set P of atomic propo- 
sitions, the set J 7 (A) of A-formulas is inductively defined by the grammar 

(A) 9 ^,V> ::=p | -L | ~^<f> | <M V> I 

where p € P and L G A is n-ary; further boolean operators (V, — >, <->, T) are defined as usual. 
Given any set X (e.g. of formulas, atomic propositions, or sets (!)), we write Prop(X) for the set 
of prepositional formulas over X and A(X) = {L(x\, . . . , x n ) \ L € A is n-ary, x\,...,x n € X} 
for the set of formulas arising by applying exactly one operator to elements of X. We instantiate 
our results to a variety of settings later with the following similarity types: 

Examples 1.1. 1. The similarity type Ak of standard modal logic consists of a single unary 
operator □. 

2. Conditional logic Q is defined over the similarity type Acl = {=^} where the binary operator 
=> is read as a non-monotonic conditional (default, relevant etc.), usually written in infix notation. 

3. Graded modal operators [ 8 ] appear in expressive description logics [ 1 ] in the guise of so-called 
qualified number restrictions; although we discuss only modal aspects, we use mostly description 
logic notation and terminology below. The operators of graded modal logic (GML) are Aqml = 
{(> k) | k € N} with (> k) unary. We write >k.<p instead of (> k)<p. A formula > k. 4> is read as 
'at least k successor states satisfy </>', and we abreviate □</> = -> > 1. -></>. 

4. The similarity type Apml of probabilistic modal logic (PML) [14] contains the unary modal 
operators L p for p G Q n [0, 1], read as 'with probability at least p, . . . '. 

We split axiomatisations of modal logics into two parts: the first group of axioms is responsible for 
axiomatising the logic w.r.t. the class of all (coalgebraic) models, whereas the second consists of 
frame conditions that impose additional conditions on models. As the class of all coalgebraic mod- 
els, introduced below, can always be axiomatised by formulas of rank 1, i.e. containing exactly one 
level of modal operators lfT7l (and conversely, every collection of such axioms admits a complete 
coalgebraic semantics HH), we restrict the axioms in the first group accordingly. More formally: 

Definition 1.2. A (modal) logic is a triple £ = (A, A,®) where A is a similarity type, A C 
Prop(A(Prop(P))) is a set of rank-1 axioms, and C (A) is a set of frame conditions. We 
say that C is a rank-1 logic if G = 0. If £ (A), we write \~c if can be derived from 
AU with the help of prepositional reasoning, uniform substitution, and the congruence rule: from 

<pi <-> ip\, . . . , 4> n <-> tp n infer L(<p\, . . . , 4> n ) <-> L(tpi, . . . , ip n ) whenever L S A is n-ary. For 
a set $ C (A) of assumptions, we write $ \~c 4> if Kc 4>\ A • • • A 4> n — > <fi for (finitely many) 
4>\, . . . , (ft n G <£. A set $ is C-inconsistent if $ \-£ _L, and otherwise C-consistent. 

Examples 1.3. 1. The modal logic K comes about as the rank-1 logic (A#, Ak, 0) where At = 
{□T,D(p -> q) -> (Up -> Dg)}. The logics K4, S4, KB, . . . arise as (A^,^4x,0) where 
contains the additional axioms that define the respective logic 0, e.g. = {Op — > in the 

case of A^4. 

2. For conditional logic, we take the similarity type Acl together with rank-1 axioms r =^> T, 
r (p —> q) — > (( r p) —> ( r q)) stating that the binary conditional is normal in its second 
argument. Typical additional rank- 1 axioms are 

(ID) a => a (identity) 

(DIS) (a => c) A (b => c) — > ((a V b) ^> c) (disjunction) 

(CM) (a 4 c) A (o =^ i)) -> ((a A i») 4 c) (cautious monotony) 

which together form the so-called System C, a modal version of the well-known KLM 
(Krauss/Lehmannn/Magidor) axioms of default reasoning due to Burgess 0. 
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3. The axiomatisation of GML given in [8 ] consists of the rank-1 axioms 

□ (p->?) (pp^nq) 
> k. p — > > /. p for I < k 

>k.p^ \f i= o,...,k^ i - (p A <?) A >( k - i)- (p A-ig) 

□ (p — > g) — > (> fc.p — > >k.q) 

Frame conditions of interest include e.g. refiexivity (p — > > l.p), symmetry (p — > □ > l.p), and 
transitivity (> 1. > n. p — > > n. p). 

To keep our results parametric also in the semantics of modal logic, we work in the framework of 
coalgebraic modal logic in order to achieve a uniform and coherent presentation. In this framework, 
the particular shape of models is encapsulated by an endofunctor T : Set — > Set, the signature 
functor (recall that such a functor maps every set X to a set TX, and every map / : X — > Y to a 
map T/ : TX — > Ty in such a way that composition and identities are preserved), which may be 
thought of as a parametrised data type. We fix the data A, C, T etc. throughout the generic part of 
the development. The role of models in then played by T-coalgebras: 

Definition 1.4. A T-coalgebra is a pair C = (C, 7) where C is a set (the state space of C) and 
7 : C — ► TC is a function, the transition structure of C. 

We think of TC as a type of successors, polymorphic in C. The transition structure 7 associates 
a structured collection of successors 7(c) to each state x € C. The following choices of signature 
functors give rise to the semantics of the modal logics discussed in Expl. 11.31 

Examples 1.5. 1. Coalgebras for the covariant powerset functor V defined on sets X by V(X) = 
{A I A C X} and on maps / by V(f)(A) = f[A] are Kripke frames, as relations R C W x W 
on a set W of worlds are in bijection with functions of type W — ► V(W). Restricting the powerset 
functor to finite subsets, i.e. putting V W {X) = {A C X [ A finite}, one obtains the class of image 
finite Kripke frames as 7-^-coalgebras. 

2. The semantics of conditional logic is captured coalgebraically by the endofunctor S that maps 
a set X to the set (P(X) — > V(X)) of selection functions over X (the action of S on functions 
/ : X — > y is given by S(f)(s)(B) = The ensuing 5-coalgebras are precisely the 
conditional frames of H. 

3. The (infinite) multiset functor maps a set X to the set BooX of multisets over X, i.e. 
functions of type X — > N U {00}. Accordingly, -coalgebras are multi graphs (graphs with edges 
annotated by multiplicities). Multigraphs provide an alternative semantics for GML which is in 
many respects more natural than the original Kripke semantics [5 ], as also confirmed by new results 
below. 

4. Finally, if supp(/u) = {x £ X \ fi(x) ^ 0} is the support of a function [i : X — ► [0, 1] 
and V(X) = {p, : X — ► [0, 1] [ supp(/u) finite, X^ex = 1} i s tne set °f finitely supported 
probability distributions on X, then P-coagebras are probabilistic transition systems, the semantic 
domain of PML. 

The link between coalgebras and modal languages is provided by predicate liftings lfl5l . which are 
used to interpret modal operators. Essentially, predicate liftings convert predicates on the state space 
X into predicates on the set TX of structured collections of states: 

Definition 1.6. |[T5l An n-ary predicate lifting (n G N) for T is a family of maps Ax : VX n — ► 
VTX, where X ranges over all sets, satisfying the naturality condition 

A X (rVi], • • • , rVnD = (r/r^AHAx, . . . , A n )\ 
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for all / : X — > Y , A±, . . . , A n G VY. (For the categorically minded, A is a natural transformation 
Q n —>■ Q o T op , where Q denotes contravariant powerset.) A structure for a similarity type A over 
an endofunctor T is the assignment of an n-ary predicate lifting [L] to every ra-ary modal operator 
L G A. 

Given a valuation V : P — > P(C) of the propositional variables and a T-coalgebra (C, 7), a 
structure for A allows us to define a satisfaction relation H(C,7,V0 between states of C and formulas 
4> G (A) by stipulating that c H(£7,7,V) P iff c G V(p) and 

c H(C, 7 ,y) ^(01, ■ ■ ■ , 0n) iff 7(c) G . . . , Unl), 

where [0J = {c G C | c Hrcvy.v) 0}* An C--model is now a model, i.e. a triple (C, 7, V) as above, 
such that c \=tcy,v) f° r au all c G C and all substitution instances ip of A U G. An C-frame is 
a T-coalgebra (C, 7) such that (C, 7, V) is an £-model for all valuations V. The reader is invited 
to check that the following predicate liftings induce the standard semantics for the modal languages 
introduced in Expl. 11.11 

Examples 1.7. 1. A structure for Ax over the covariant powerset functor V is given by 
= {Y G V(X) I Y C A}. The frame classes defined by the frame conditions men- 
tioned in Expl. ll.3fT1 are well-known; e.g. a Kripke frame (X, R) is a AT4-frame iff R is transitive. 

2. Putting [=>]x(-A, -B) = {/ G S(X) \ f(A) C P} reconstructs the semantics of conditional 
logic in a coalgebraic setting. 

3. A structure for GML over fioo is given by [(> k) j x (A) = {/ : X -> NU{oo} | Ex G a/( x ) ^ 
/c}. The frame conditions mentioned in Expl. I1.3l3l correspond to conditions on multigraphs that 
can be read off directly from the logical axioms. E.g. a multigraph satisfies the transitivity axiom 
> 1. >n.p—y >n.p iff whenever x has non-zero transition multiplicity to y and y has transition 
multiplicity at least n to z, then x has transition multiplicity at least n to z. 

4. The structure over V that captures PML coalgebraically is given by the the predicate lifting 
\L P ix{A) = {nE V(X) I 52 xeA /x(z) > p} for p G [0, 1] n Q. 

From now on, fix a modal logic C = (A, A, 0) and a structure for A over a functor T. We say that 
C is strongly complete for some class of models if every /^-consistent set of formulas is satisfiable 
in some state of some model in that class. Restricting to finite sets defines the notion of weak 
completeness; many coalgebraic modal logics are only weakly complete ifTTi . 

Definition 1.8. Let A be a set. If ip G .F(A) and r : P — > V{X) is a valuation, we write i^t for 
the result of substituting r(p) for p in ip, with propositional subformulas evaluated according to the 
boolean algebra structure of V{X). (Hence, ipr is a formula over the set V(X) of atoms.) A formula 
(j) G Prop(A(7 :, (A)) is one-step C-derivable, denoted hj. ctj, if is propositonally entailed by the 
set {V>r I r : P — > V(X),tfj G .A}. A set $ C Prop(A(P(A))) is one-step C-consistent if there do 
not exist formulas (f>x, . . . , (j) n G $ such that hi -■(^i A • • • A cj) n ). Dually, the one-step semantics 
Uf x G TX of a formula G Prop(A(P(A)) is defined inductively by \L(A U . . .,A n )f x = 
\L\x{A\, . . . , An) for A t , . . . , A n C X. A set $ C Prop(A(P(A))) is one-step satisfiable if 
fl^$Wx 7^ ^- ^ e sa y tnat ^ ( or ^) i s separating if t G TX is uniquely determined by the set 
{eft G A(P(A)) I i G [^Ixl- We call £ (or A) one-step sound if every one-step derivable formula 
(j) G Prop(A(P(A))) is one-step valid, i.e. {(j)j x = X. 

Henceforth, we assume that C is one-step sound, so that every T-coalgebra satisfies the rank-1 
axioms; in the absence of frame conditions (0 = 0), this means in particular that every T-coalgebra 
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is an £-frame. The above notions of one-step satisfiability and one-step consistency are the main 
concepts employed in the proof of strong completeness in the following section. 

Given a structure for A over T, every set B of rank-1 axioms over A defines a subfunctor Tg of 
B with T B (X) = f|{[<Hx I <t> G B, r : P -> V{X)} C TX. This functor induces a structure for 
which B is one-step sound. 

Example 1.9. The additional rank-1 axioms of Expl. [l.3l2l induce subfunctors Sb of the functor S 
of Expl. 11.5121 E.g. we have 

S {ID} X = {/ G S(X) I WL C X. f(A) C A} 

5{ZD,.D/S}* = {/ e 5 P0 I 5 C X /(A) CiA/(iUB)C /(A) U /(B)} 

^{JZ^/s.cm}* = {/ e | VA, B c X /(A) C ^ A (/(B) c ^ f(A) n B C /(B))} 

(it is an amusing exercise to verify the last claim). 

2. Strong Completeness Via Quasi-Canonical Models 

We wish to establish strong completeness of £ by defining a suitable T-coalgebra structure ( on 
the set S of maximally ^-consistent subsets of J 7 (A), equipped with the standard valuation V(p) = 
{T G S | p G T}. The crucial property required is that ( be coherent, i.e. 

C(T)€[L] (&,..., 4) L(^,...,0 n )€r, 

where = {A G S | G A}, for L G A ra-ary, T G S, and 0i, . . . , 4> n G ^"(A), as this allows 
proving, by a simple induction over the structure of formulas, 

Lemma 2.1 (Truth lemma). If( is coherent, then for all formulas (ft, T \=(s,C,V) 4> iff 4> € r. 

We define a quasi-canonical model to be a model (5, C, V) with C coherent; the term quasi-canonical 
serves to emphasise that the coherence condition does not determine the transition structure ( 
uniquely. By the truth lemma, quasi-canonical models for C are ^-models, i.e. satisfy all sub- 
stitution instances of the frame conditions. The first question is now under which circumstances 
quasi-canonical models exist; we proceed to establish a widely applicable criterion. This criterion 
has two main aspects: a local form of strong completeness involving only finite sets, and a preser- 
vation condition on the functor enabling passage from finite sets to certain infinite sets. We begin 
with the latter part: 

Definition 2.2. A surjective u-cochain (of finite sets) is a sequence (X)ngN of (finite) sets 
equipped with surjective functions p n : X+i — * X n called projections. The inverse limit lim X n 
of (X n ) is the set {(xj) G n«gN^ I ^ n -Pn{x n+ \) = x n } of coherent families (xi). The limit 
projections are the maps 7Tj((x n ) ng N) = Xj, z G N; note that the 7Tj are surjective, i.e. every x G X 
can be extended to a coherent family. Since all set functors preserve surjections, (TX n ) is a sur- 
jective w-cochain with projections Tp n . The functor T weakly preserves inverse limits of surjective 
ui-cochains of finite sets if for every surjective o;-cochain (X n ) of finite sets, the canonical map 
T(lim X n ) — ► lim TX n is surjective, i.e. every coherent family (t n ) in Y[ TX n is induced by a (not 
necessarily unique) t G T(limX) in the sense that Tir n {f) = t n for all n. 

Example 2.3. Let A be a finite alphabet; then the sets A n , n G N, form a surjective w-cochain of 
finite sets with projections p n : A n+1 — > A n , (a±, . . . , a n+ i) \— > (oj, . . . , a n ). The inverse limit 
lim A n is the set A u of infinite sequences over A. The covariant powerset functor V preserves this 
inverse limit weakly: given a coherent family of subsets B n C A n , i.e. p n [B n+ i] = B n for all n, 
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we define the set B C A u as the set of all infinite sequences (a n ) n >i such that (ai, . . . , a„) G B n 
for all n; it is easy to check that indeed B induces the B n , i.e. n n [B] = B n . However, B is by no 
means uniquely determined by this property: Observe that B as just defined is a safety property. The 
intersection of B with any liveness property C, e.g. the set C of all infinite sequences containing 
infinitely many occurrences of a fixed letter in A, will also satisfy ir n [B n C] = B n for all n. 

The second part of our criterion is an infinitary version of a local completeness property called 
one-step completeness, which has been used previously in weak completeness proofs lfT31[T7l . 

Definition 2.4. We say that C is strongly one-step complete over finite sets if for finite X, every 
one-step consistent subset $ of Prop(A(7 3 (X))) is one-step satisfiable. 

The difference with plain one-step completeness is that above may be infinite. Consequently, 
strong and plain one-step completeness coincide in case the modal similarity type A is finite, since 
in this case, Ptop(K{V{X))) is, for finite X, finite up to prepositional equivalence. The announced 
strong completeness criterion is now the following. 

Theorem 2.5. If C is strongly one-step complete over finite sets and separating, A is countable, 
and T weakly preserves inverse limits of surjective u-cochains of finite sets, then C has a quasi- 
canonical model. 

Proof sketch. The most natural argument is via the dual adjunction between sets and boolean alge- 
bras that associates to a set the boolean algebra of its subsets, and to a boolean algebra the set of its 
ultrafilters. For economy of presentation, we outline a direct proof instead: we prove that 
(*) every maximally one-step consistent $ C Prop(A(2l)) is one-step satisfiable, 
where 21 = {0 | G F(A)} C V(S). 

The existence of the required coherent coalgebra structure £ on S follows immediately, since the 
coherence requirement for C(T), T G S, amounts to one-step satisfaction of a maximally one-step 
consistent subset of Prop(A(2t)). 

To prove (*), let A = {L n \ n G N}, let P = {p n \ n G N}, let T n denote the set of A-formulas 
of modal nesting depth at most n that employ only modal operators from A n = {Lo, . . . ,L n } and 
only the atomic propositions po,...,p n , and let S n be the set of maximally consistent subsets of T n . 
Then S is (isomorphic to) the inverse limit lim S n , where the projections S n+ i — > S n and the limit 
projections S —> S n are just intersection with T n . As the sets S n are finite, we obtain by strong one- 
step completeness t n G TS n such that t n \=g $ n Prop(A(2l n )), where 2l n = {<p H S n \ 4> G T n }. 
By separation, (t n ) n& ^ is coherent, and hence is induced by some t G TS by weak preservation of 
inverse limits; then, t \=g <J>. ■ 

Together with the Lindenbaum Lemma we obtain strong completeness as a corollary. 

Corollary 2.6. Under the conditions ofThm. 12.51 C is strongly complete for C-models. 

Both Thm. |2.5| and Cor. 12. 61 do apply to the case that C has frame conditions. When C is of rank 1 
(i.e. = 0), Cor. 12.61 implies that C is strongly complete for (models based on) £-frames. In 
the presence of frame conditions, the underlying frame of an £-model need not be an £-frame, so 
that the question arises whether C is also strongly complete for £-frames. In applications, positive 
answers to this question, usually referred to as the canonicity problem, typically rely on a judicious 
choice of quasi-canonical model to ensure that the latter is an £-frame, often the largest quasi- 
canonical model under some ordering on TS. Detailed examples are given in Sec. [3] 

Remark 2.7. It is shown in fT3l that T admits a strongly complete modal logic if T weakly pre- 
serves (arbitrary) inverse limits and preserves finite sets. The essential contribution of the above 
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result is to remove the latter restriction, which fails in important examples. Moreover, the observa- 
tion that we need only consider surjective u>cochains is relevant in some applications, see below. 

Remark 2.8. A last point that needs clearing up is whether strong completeness of coalgebraic 
modal logics can be established by some more general method than quasi-canonical models of the 
quite specific shape used here. The answer is negative, at least in the case of rank-1 logics C: it has 
been shown in [12] that every such C admits models which consist of the maximally satisfiable sets 
of formulas and obey the truth lemma. Under strong completeness, such models are quasi-canonical. 

This seems to contradict the fact that some canonical model constructions in the literature, 
notably the canonical Kripke models for graded modal logics (U |6j, employ state spaces which 
have multiple copies of maximally consistent sets. The above argument indicates that such logics 
fail to be coalgebraic, and indeed this is the case for GML with Kripke semantics. As mentioned 
above, GML has an alternative coalgebraic semantics over multigraphs, and we show below that 
this semantics does admit quasi-canonical models in our sense. 

3. Examples 

We now show how the generic results of the previous section can be applied to obtain canonical 
models and associated strong completeness and compactness theorems for a large variety of struc- 
turally different modal logics. We have included some negative examples where canonical models 
necessarily fail to exist due to non-compactness, and we analyse which conditions of Thm. l2.5l fail 
in each case. We emphasise that in the positive examples, the verification of said conditions is 
entirely stereotypical. Weak preservation of inverse limits of surjective oj-cochains usually holds 
without the finiteness assumption, which is therefore typically omitted. 

Example 3.1 (Strong completeness of Kripke semantics for K). Recall from Expl. ll.5fT1 that Kripke 
frames are coalgebras for the powerset functor TX = V(X). Strong completeness of K with 
respect to Kripke semantics is, of course, well known. We briefly illustrate how this can be derived 
from our coalgebraic treatment. To see that K is strongly one-step complete over finite sets X, 
let $ C Prop(Ajc(V(X))) be maximally one-step consistent. It is easy to check that {x G X \ 
0{x} G <&} satisfies <£. To prove that the powerset functor weakly preserves inverse limits, let (X n ) 
be an u;-cochain, and let (A n G V{X n )) be a coherent family. Then (A n ) is itself a cochain, and the 
set A = lim A n C limX n induces (A n ) (w.r.t. the subset ordering on V{X)). Separation is clear. 
By Thm.^21 there exists a quasi-canonical Kripke model for all normal modal logics. In particular, 
the standard canonical model [4] is quasi-canonical; it witnesses strong completeness (w.r.t. frames) 
of all canonical logics such as KA, 54, 55. 

Example 3.2 (Failure of strong completeness of K over finitely branching models). As seen in 
Expl. 11.5111 finitely branching Kripke frames are coalgebras for the finite powerset functor V w . 
It is clear that quasi-canonical models fail to exist in this case, as compactness fails over finitely 
branching frames: one can easily construct formulas <j> n that force a state to have at least n different 
successors. The obstacle to the application of Thm. 12.51 is that the finite powerset functor fails to 
preserve inverse limits weakly, as the inverse limit of an w-cochain of finite sets may fail to be finite. 

Example 3.3 (Conditional logic). Recall from Expl. 11.5121 that the conditional logic CK is inter- 
preted over the functor S{X) = V{X) — > V{X). To prove strong one-step completeness over finite 
sets X, let $ C Prop(A C L(^(^))) be maximally one-step consistent. Define / : V{X) -> V(X) 
by f(A) = f]{B CI|i=>fie $}; it is mechanical to check that / |= x To see that S weakly 
preserves inverse limits, let (X n ) be a surjective w-cochain, let X = limX n , and let (f n G S(X n )) 



STRONG COMPLETENESS OF COALGEBRAIC MODAL LOGICS 



681 



be coherent. Define / : V(X) — > V(X) by letting (x n ) £ f(A) for a coherent family (x n ) £ X 
iff whenever A = vr^fi?] for some n and some B C X n , then x n £ fn(B). Using surjectivity 
of the projections of (X n ), it is straightforward to prove that / induces (/„). Finally, separation 
is clear. By Thm. 12.51 it follows that the conditional logic CK has a quasi-canonical model, and 
hence that CK is strongly complete for conditional frames. In the case of the additional rank-1 
axioms mentioned in Expl. ll.3l2l and the corresponding subfunctors of S described in Expl. |1.9l the 
situation is as follows. 

Identity: The functor S^ ID j weakly preserves inverse limits of surjective w-cochains. In the 
notation above, put (x n ) £ f(A) iff the condition above holds and (x n ) £ A. 

Identity and disjunction: The functor S^ijy^iS} weakly preserves inverse limits of surjective 
w-cochains: put (x n ) £ f{A) iff (x n ) £ A and whenever (x n ) £ tt^B C A, then x m £ f m (B). 

System C: It is open whether the the functor S{jd,dis,CM} weakly preserves inverse limits of 
surjective cj-cochains, and whether System C is strongly complete over conditional frames. 

Indeed it appears to be an open problem to find any semantics for which System C is strongly 
complete, other than the generalised neighbourhood semantics as described e.g. in lfl8ll . which is 
strongly complete for very general reasons but provides little in the way of actual semantic infor- 
mation. The classical preference semantics according to Lewis is only known to be weakly com- 
plete [3]. Friedman and Halpern [9] do silently prove strong completeness of System C w.r.t. plau- 
sibility measures; however, on close inspection the latter turn out to be essentially equivalent to the 
above-mentioned generalised neighbourhood semantics. Moreover, Segerberg [19] proves strong 
completeness for a whole range of conditional logics over general conditional frames, where, in 
analogy to corresponding terminology for Kripke frames, a general conditional frame is equipped 
with a distinguished set of admissible propositions limiting both the range of valuations and the 
domain of selection functions. In contrast, our method yields full conditional frames in which the 
frame conditions hold for any valuation of the prepositional variables. While in the case of CK and 
its extension by ID alone, these models differ from Segerberg's only in that they insert default val- 
ues for the selection function on non-admissible propositions, the canonical model for the extension 
of CK by {ID, DIS} has non-trivial structure on non-admissible propositions, and we believe that 
our strong completeness result for this logic is genuinely new. 

Example 3.4 (Strong completeness of GML over multigraphs). Recall from Expl. II .5(31 that graded 
modal logic (GML) has a coalgebraic semantics in terms of the multiset functor Boq. To prove 
strong one-step completeness over finite sets X, let <E> C Ptop{Kgml{'P{X))) be maximally one- 
step consistent. We define B £ Boo(X) by B(A) > n > n. A £ <£; it is easy to check that B 
is well-defined and additive. To prove weak preservation of inverse limits, let (X n ) be an cu-cochain, 
let X = limX n , and let (B n £ B 00 (X n )) be coherent. Then define B £ B OQ (X) pointwise by 

B({x n )) = min5 n (x n ), 

ngN 

noting that the sequence (B n (x n )) is decreasing by coherence. A straightforward computation 
shows that B induces (B n ). Separation is clear. 

By the above and Thm. 12.51 all extensions of GML have quasi-canonical multigraph models. 
While the technical core of the construction is implicit in the work of Fine [8] and de Caro 0, 
these authors were yet unaware of multigraph semantics, and hence our result that GML is strongly 
complete over multigraphs has not been obtained previously. 

The standard frame conditions for reflexivity, symmetry, and transitivity (Expls. 11.5131 
and 11.71 [3]) and arbitrary combinations thereof are easily seen to be satisfied in the quasi-canonical 
model constructed above. We point out that this contrasts with Kripke semantics in the case of the 
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graded version of 54, i.e. GML extended with the reflexivity and transitivity axioms of Expl. ll.5l3l 
as shown in 0, the complete axiomatisation of graded modal logic over transitive reflexive Kripke 
frames includes two rather strange combinatorial artefacts, which by the above disappear in the 
multigraph semantics. The reason for the divergence (which we regard as an argument in favour of 
multigraph semantics) is that, while in many cases multigraph models are easily transformed into 
equivalent Kripke models by just making copies of states, no such translation exists in the transitive 
reflexive case (transitivity alone is unproblematic). 

Observe moreover that the above extends straightforwardly to decription logics ACCQ(1Z) 
with qualified number restrictions and a role hierarchy 1Z where roles may be distinguished as, in any 
combination, transitive, reflexive, or symmetric. As shown in iflOl [TT1 . ACCQ(1Z) is undecidable 
for many 1Z, even when only transitive roles are considered. For undecidable logics, completeness 
is in some sense the 'next best thing', as it guarantees if not recursiveness then at least recursive 
enumerability of all valid formulas, and hence enables automatic reasoning. Essentially, our results 
show that the natural axiomatisation of ACCQ{1Z) with transitive, symmetric and reflexive roles is 
strongly complete over multigraphs, a result which fails for the standard Kripke semantics. 

Example 3.5 (Failure of strong completeness of image-finite GML). Similarly to the case of image- 
finite Kripke frames, one can model an image-finite version of graded modal logic coalgebraically 
by exchanging the functor B^ for the finite multiset functor B, where B{X) consists of all maps 
X — > N with finite support. Of course, the resulting logic is non-compact and hence fails to admit 
a canonical model. This is witnessed not only by the same family of formulas as in the case of 
image-finite Kripke semantics, which targets finiteness of the number of different successors, but 
also by the set of formulas {> n. a \ n E N}, which targets finiteness of multiplicities. Analysing 
the conditions of Thm. 12.51 we detect two violations: not only does weak preservation of inverse 
limits fail, but there is also no way to find an axiomatisation which is strongly one-step complete 
over finite sets (again, consider sets {> n. {x} \ n G N}). 

Strong completeness of image-finite GML can be recovered by slight adjustments to the syntax and 
semantics. We formulate a more general approach, as follows. 

Example 3.6 (Strong completeness of the logic of additive measures). We fix an at most countable 
commutative monoid M (e.g. M = N). We think of the elements of M as describing the measure 
of a set of elements. To ensure compactness, we have to allow some sets to have undefined measure. 
That is, we work with coalgebras for the endofunctor Tm defined by 

T M (X) = {(21, p) | 21 C V(X) closed under disjoint unions, p, : 21 -> M additive} 

The modal logic of additive M- valued measures is given by the similarity type Am = {E m \ m G 
M} where E m (j) expresses that 4> has measure m, i.e. 

\E m \ x B = {(21, p) G T M (X) | B G %n(B) = m}. 

Am is clearly separating. The logic is axiomatised by the following two axioms: 

E m a — > ~^E n a (n ^ m) and E m (a A b) A E n (a A -fo) — > E m+n a. 

These axioms are strongly one-step complete over finite sets X: if <3? C Prop(Ajvf(7 3 (X))) is 
maximally one-step consistent, then (21, fi) |= 1 $ where A G 21 iff E m A G $ for some necessarily 
unique m, in which case fi(A) = m. Moreover, Tm weakly preserves inverse limits X = limX n , 
with finite X n : a coherent family ((2t n ,/x n ) G Tm(X h )) is induced by (21, p) G Tm{X), where 
21 = {vr" 1 ^] | n G N, B G 2t n } and //(tt" 1 ^]) = p n (B) is easily seen to be well-defined and 
additive. Theorem 12.51 now guarantees existence of quasi-canonical models. A simple example is 
M = Z/2Z, which induces a logic of even and odd. 
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For the case M = N, we obtain a variant of graded modal logic with finite multiplicities, where 
we code > k.<f) as -i \J 0<i<k ^k4>- However, it may still be the case that a state has a family of 
successor sets of unbounded measure, so that undefinedness of the measure of the entire state space 
just hides an occurrence of infinity. This defect is repaired by insisting that the measure of the whole 
state space is finite at the expense of disallowing the modal operator Eq in the language, as follows. 

Example 3.7 (Strong completeness of finitely branching GML~). To force the entire state space to 
have finite measure, we additionally introduce a measurability operator E, interpreted by \E\B = 
{(21, /i) | B G 21}, and impose obvious axioms guaranteeing that measures on X are defined on 
boolean subalgebras of V(X), in particular ET (i.e. fi(X) is finite), and E n a — > Ea. In order to 
achieve compactness, we now leave a bolt hole on the syntactical side and exclude the operator Eq. 
In other words, the syntax of GML~ is given by the similarity type Aq ML = {E} U {E n \ n > 0}, 
and we interpret GML~ over coalgebras for the functor Bm defined by 

B M {X) = {(21, fj) | 21 boolean subalgebra of V{X),n : 21 -> N additive}. 

Separation is clear. The axiomatisation of GML~ is given by the axiomatisation of the modal logic 
of additive measures, the above-mentioned axioms on E, and the additional axiom 

E n a A Eb -> E„(o A i)) V E n (a A -6) V \f 0<k<n (E k (a A b) A E n _ k (a A -A)) 

which compensates for the absence of Eq. Strong one-step completeness over finite sets and weak 
preservation of inverse limits is shown analogously as in Expl. 13-61 so that we obtain a strongly 
complete finitely branching graded modal logic GML~. The tradeoff is that the operator > k.<j> is 
no longer expressible as -> \f 0<i<k E^ in GML~ which only allows to formulate the implication 

> 1.0 — > >n.<j). 

Example 3.8 (Failure of strong completeness for PML over finitely supported probability distribu- 
tions). Like image-finite graded modal logic, probabilistic modal logic as introduced in Expl. I1.5l4l 
fails to be compact, and violates the conditions of Thm. 12.51 on two counts, namely weak preser- 
vation of inverse limits and strong one-step completeness over finite sets. The first issue is related 
to image-finiteness, while the second is rooted in the structure of the real numbers: e.g. the set 
{Li/2-i/ n a \ n G N} U { _, ^i/2«} is finitely satisfiable but not satisfiable. 

Example 3.9 (Strong completeness of the logic of exact probabilities). In order to remove the 
above-mentioned failure of compactness, we consider the fragment of probabilistic modal logic 
containing only operators E p stating that a given event has probability exactly p. (This is, of course, 
less expressive than the operators L p but still allows reasonable statements such as that rolling a six 
on a die happens with probability 1/6.) Moreover, we require probabilities to be rational and allow 
probabilities to be undefined, thus following the additive measures approach as outlined above, 
where we consider a subfunctor of Tq defined by the requirement that the whole set has measure 1. 
However, we are able to impose stronger conditions on the domain 21 C V{X) of a probability 
measure P on X: we require that X G 21 and that A, B G 21, B C A imply A — B G FA, which is 
reflected in the additional axioms E\~T and E p a f\E q (a A 6) — > E p ^ q {a A ->&). It is natural that we 
cannot force closure under intersection, as there is in general no way to infer the exact probability 
of A n B from the probabilities of A and B. Along the same lines as above, we now obtain quasi- 
canonical models, and hence strong completeness and compactness, of the arising modal logic of 
exact probabilities. 
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4. Conclusion 

We have laid out a systematic method of proving existence of canonical models in a generic seman- 
tic framework encompassing a wide range of structurally different modal logics. We have shown 
how this method turns the construction of canonical models into an entirely mechanical exercise 
where applicable, and points the way to obtaining compact fragments of non-compact logics. As 
example applications, we have reproved a number of known strong completeness result and estab- 
lished several new results of this kind; specifically, the latter includes strong completeness of the 
following logics. 

• The modal logic of exact probabilities, with operators E p 'with probability exactly p\ 

• Graded modal logic over transitive reflexive multigraphs, i.e. the natural graded version of 
SA, and more generally description logic with role hierarchies including transitive, reflexive, and 
symmetric roles and qualified number restrictions also on non-simple (e.g. transitive) roles. 

• The conditional logic CK+{ID, DIS}, i.e. with the standard axioms of identity and disjunc- 
tion, interpreted over conditional frames. 

A number of interesting open problems remain, e.g. to find further strongly complete variants of 
probabilistic modal logic or to establish strong completeness of the full set of standard axioms of 
default logic, Burgess' System C 0, over the corresponding class of conditional frames. 
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